MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4f8894bcfb45d9c5185af6978aa7340bdc3373833ff88fc8f2c46364650cc4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BazaLoader


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4f8894bcfb45d9c5185af6978aa7340bdc3373833ff88fc8f2c46364650cc4f
SHA3-384 hash: d09d9393371bc4ff6b5ede87b9e24da468ba5158ee35f814b0adea57955bd36de4dc9421de008b87143b223ce33087f9
SHA1 hash: f6999d5e8caae2b8970bffcfa4d8848f539f708e
MD5 hash: 2e4f2c48b719e102842ddab792e229b8
humanhash: glucose-whiskey-sixteen-fish
File name:coevRM2v.exe
Download: download sample
Signature BazaLoader
Create hunting rule
File size:219'648 bytes
First seen:2021-06-24 19:11:09 UTC
Last seen:2021-06-24 19:48:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 363722c496926cda78eb9319ff33f1f3 (1 x BazaLoader)
ssdeep 6144:dAZERKpqhxsdrnLLroAKggDpSI20VYpXaaqyuiZZ+/:fRxsdr7oA9Mi0YwyZz+
Threatray 46 similar samples on MalwareBazaar
TLSH 0024BF7BB26034E9E2BE4236C6816999B37235724956DFCF01B457D30E233A1DE2AF11
Reporter James_inthe_box
Tags:BazaLoader exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
coevRM2v.exe
Verdict:
No threats detected
Analysis date:
2021-06-24 19:14:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/70eeaaae-e183-430f-9947-06c580315fc2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/168128/
Detection(s):
SecuriteInfo.com.generic.ml.16681.29433.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/807718
Signature
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Modifies the context of a thread in another process (thread injection)
Sample uses process hollowing technique
Sets debug register (to hijack the execution of another thread)
Sigma detected: Suspicious Svchost Process
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4f8894bcfb45d9c5185af6978aa7340bdc3373833ff88fc8f2c46364650cc4f/
Verdict:
suspicious
Similar samples:
1a3966c451b11eb826dd957505477506b44d3fa8d4579febe4670ea6b228bfff
BazaLoader
2e5275c35b262674705f3c2bd6becc80a067f2660798881d0f5344ac97bd592d
BazaLoader
5edd735e3c6b81d985f3eadd1f8cae24091b947699f1152528566124f22d5341
BazaLoader
6c499f0fb04581d0b02d532cec44b9f39c571ac5d4ae7f0b4bff6957a5bab329
BazaLoader
adeab1a6529802e60f8cab213a29de3cb46f249e2cab8d7c9a7c16ccd8541a9d
BazaLoader
cca0563ae1aac9447ba5e3f73cafc63a21671e478dc198695db6c698a2a17d2b
BazaLoader
d22f536d4d6cc001271855f4467af0bbc656801e1ffa34a8acd905db56cebae0
BazaLoader
f0548ac778c8bcea06c577a13e7b0856b73838715c2fab1b1e83096e2333f82f
BazaLoader
f554be4d3d5b1f05f69038bbe54acb8e92ae5b0e45368e2108ecfde515dc8d9f
BazaLoader
fea4f9bef08bc96706182b62d1ebcd4aeacaee3fb91f52dee31fd0838b8386ac
BazaLoader
+ 36 additional samples on MalwareBazaar
Result
Malware family:
bazarloader
Create hunting rule
Score:
  10/10
Tags:
family:bazarbackdoor family:bazarloader backdoor dropper loader
Link:
https://tria.ge/reports/210624-1dhp1jj4ne/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Bazar/Team9 Backdoor payload
Bazar/Team9 Loader payload
Bazar Loader
BazarBackdoor
Unpacked files
SH256 hash:
d4f8894bcfb45d9c5185af6978aa7340bdc3373833ff88fc8f2c46364650cc4f
MD5 hash:
2e4f2c48b719e102842ddab792e229b8
SHA1 hash:
f6999d5e8caae2b8970bffcfa4d8848f539f708e
Link:
https://www.unpac.me/results/c54f39b8-2fe5-421c-8a48-5ea799423bf3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d4f8894bcfb45d9c5185af6978aa7340bdc3373833ff88fc8f2c46364650cc4f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SPLCrypt
Create hunting rule
Author:James Quinn, Binary Defense
Description:Identifies SPLCrypt, a new crypter associated with Bazaloader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/168128/

Comments